Shadow AI: Your Staff Are Already Using It. Here's How to Fix It | Nerds News Special

What shadow AI is and why this is a special edition

Welcome to this emergency episode, I guess on extreme, emergency episode, we’ll call it a special episode of the Nerds News. It is Monday, not our normal Thursday edition. And this emergency special edition of the Nerds News is because we’ve gotten so much feedback, so much discussion, and people concerned about what’s happening with AI, and especially what’s happening with AI in their business.

Every business I walk into is already using AI, all of them. And almost none of them made the decision to, none of them decided to. If you’re the owner, and you have concerns about AI, I guarantee you it’s being used. And I guarantee you that you didn’t sit down and create all the things you need to do to make a good decision around what, if it should be used, and how it should be used, and what should go into it, and all that good stuff.

So we like to call the AI that’s being used, without anybody knowing about it, except for the people using it, we like to call that shadow AI. It’s AI tools your staff use for company work that the company never approved. And this is where it’s really bad, because it’s usually a personal ChatGPT, or Copilot, or Gemini account. And it could be on a phone. It could be on a computer.

It could be in a browser. It could be a whole bunch of different ways that they can get to it. And what’s kind of scary about it is the free accounts are very powerful, so they can get a lot of work done and create a lot of damage at the same time. So why are we talking about this now? Why is this the emergency special edition?

Because it went from a curiosity, you know, people are interested in it. To a, what we’ll call it, a normal way to work. And it happened in the last 18 months. Most homeowners have not caught up with that. It’s literally become an issue that has gone from just a fun little thing to something very serious that quickly.

How big it is: PagerDuty, Gartner, Microsoft, IBM

So how big is this? Well, let’s look at some numbers. So a company called PagerDuty did a survey in June of what they found. This year is 2026. 66% of office workers have used AI tools they believe were not allowed at work. And then 88% have put work information into a public AI tool. A third of them customer data, a third financial, or confidential documents.

So your employees, 66% of them, are using the tools, whether you know it or not, whether you’re giving them permission to it. And why are they doing that? Well, I don’t know. Could be because it’s… It makes their job so much easier. It’s such a powerful tool. It’d be like asking them not to use a vehicle and walk somewhere when they can use a vehicle.

So, all right, 88%. I’ve used it whether you like it or not. And a third of them put customer data. And a third have put financial or confidential documents. So they’re feeding your customer data and financial or confidential documents into this tool. And they’re using these public AIs.

But it doesn’t say public. It says AI tools. So that’s important, right? Public AI versus private tools. We’ll get into that, why that’s a big deal. Another big number here. Gartner, 68% of employees use unauthorized AI. This is Gartner. We’ve gone from PagerDuty.

I don’t know who PagerDuty is, but I know who Gartner is. 68% of employees use unauthorized AI. Up from 41% in 2023. So we’re already at 41% in 2023. Now we’re in 26 and we’re hitting 68%. So it’s unauthorized. They’re using the tool. They haven’t been given permission. Again, why are they doing that?

Because they’d rather drive than walk. All right. Let’s keep going. This doesn’t concern you enough. Microsoft, LinkedIn. So Microsoft in there. Terrible website, LinkedIn. Work trend index. Small and medium companies. 80% of knowledge workers bring their own AI.

80%. So if you’re not providing it, they’re bringing it. And it’s either it’s a public free AI or they could even be paying for it. And if it’s not configured correctly, whatever they’re putting into that AI could be part of what goes into the AI as training data. Because these AIs are sucking this information in. You know that. So, yeah. Bring your own AI.

Small businesses is where this is the worst. So big corporations. If you’ve got a big corporation, no big deal. They got it locked down. It’s a small business only. This is a problem. All right. Let’s keep going. So we’ve gone from Gartner to Microsoft.

How about what does IBM have to say about this? A 2026 breach report. Shadow AI involved in 43% of industries in 2020. Up from 20% the year before. So we went from 20% of incidents breaches, which are breaches are huge. Access to your data that you didn’t want. Jumped from 20% of them coming from AI just last year to 43% today.

2026. So that’s a better than 100% increase year over year because of these tools. And breaches are bad. We don’t ever want to see a breach. So it. Well, there’s another number here. 20% of the year before and breaches involving it costs about $400,000 more than average. So. Incident rate has gone up.

And the cost alone. Just as an average is $400,000. That’s how much. This breach is costing you. On average. So. So. I don’t know.

Your best people, not bad guys

What we’re talking about. We’re not talking about bad guys. We’re talking about your best people doing their best work using the best tools. And that’s. Like I said. If. Why draw. Why walk when you can drive. Why take a bus when you can take a plane.

And not only is it a plane, but it’s a cheap plane. It’s like. Getting Delta quality. Discount airline. Prices. Up to. Including free. So. This isn’t just bad guys being. Doing bad things. This is your people doing their best to.

Do the best for you that they can do. All right. Very interesting. Let’s continue.

What it looks like in a real shop: quotes and pricing

So what does it look like in a real shop? What’s going on in your business? One thing I can guarantee you that’s happening that I know is happening. Cause I’ve talked to people about it. Is. Quote generation. And. I would say that.

Most people don’t even think about. How important it is and why we would even care. So. You have a manufacturing company that does custom manufacturing. Of things. And every quote is a big deal because every quote is unique. The general guidelines around it, but for the most part.

So if you have an AI tool that can make that extreme. Streaming. More quickly. You can do it better. It can be more consistent. So it’s a, it’s a powerful tool. It’s something that. You’re you want to use your, you want your employees to use. But what’s happening is when you use the free tools or if you don’t have your.

AI program correctly. That information that you’re generating pricing. Client. The. Method methodology you use for creating the quote. All gets fed into the AI. And at the end of the day, what you’re doing is. Is your training. AI on how you do your business so that it can.

Turn around. And use that same information for your competitors. So when they’re using. To get a quote. The point directly from the knowledge and wisdom that you earned over the years. And they’re going to use that. To create a quote.

The bookkeeper and your P&L

Even deeper, you will keep her. She’s got AI tools, you don’t know about it. She’s taking the profit and loss, she’s taking asset lists, she’s taking things like, I don’t know, your money you spend on administration or for parts or for whatever any any of the information you bookkeeper might summarize for you in a report and she’s just taking that to Gemini and dumping that information in there with her free account and then now that report that used to take an hour two hours a day who knows, is getting pumped out in 30 seconds,

five minutes, and it’s got better knowledge, better insights, better organized, it’s way better. But what’s the cost? Well, all of your most intimate financial information is now available to the AI for training. AI knows that about you. So that’s, you know, if you want to train your competitors on how your financials work, more power to you. I would highly recommend we not do that. All right.

Blocking it at the firewall doesn’t work

So let’s talk about, let’s pretend that you did actually try and stop this. We’re going to control it. We’re going to stop our team from getting the ChatGPT from the firewall. Well, it’s just as easy for somebody to use their cell phone to get around those restrictions. You’re not stopping it just by that. You need to have teeth. All right.

Customer data and your obligations

Customer data. This is probably the biggest one. I mean, it’s bad that we’re training our competitors on how we do our business, but we have a fiduciary responsibility. We have a responsibility to protect our customers’ information. And if our employees are feeding customer information into AIs, and the AIs are training on it, or the AIs are sucking it in for whatever purposes these companies use this data for, we’re not doing our job. And in some cases, it’s illegal.

So if you’re doing defense work or you’re in healthcare, you can’t do that. You cannot allow that information to walk out the door. It’s a big deal. All right. Segment number three, we’re getting into the home run here in a home set stretch.

The three fixes

So how do we fix this? What are the three things we can do to fix it? Well, number one, visibility. You cannot write a rule for tools you do not know about. Microsoft 365 sign-in and app consent logs show more than people expect. That is the first thing the ACS readiness assessment looks at.

All right. So we’re going to look at where are people signing in. What kind of information can we pull from from firewalls, from the browser history so that we know what is being used, who’s using it, how it’s getting used. Number two, a well-written policy people have to physically sign. We’re going to prove tools. We’re going to prove what data can go into those tools. And we’re going to review everything that goes out.

And what happens if they break it? Have a lawyer take a look at it. We’re going to create a policy. We’re going to go and let everybody know what the ramifications are. So let’s talk about this. We have for you a written policy.

Free AI policy template

Oh, it’s it. You can download it right now. It’s free. acsapp.com slash AI policy. So this is a policy you can bring to your team. That’s going to have the approved tools. It’s going to have what data can go into it.

So this is step number two, written policy. We’re providing this for you for free right now. acsapp.com slash AI policy. You can have your lawyer look at it. See if it fits. That’s what you need. AI policy of what happens when they break the rules, where the rules are.

So nobody has confusion. And then the third thing to do is give people an approved path. You got to give them the tools because these tools are going to be good for you. Maybe even better for you than it is for them. People want to do a good job. And if you had said in 1992, you can’t use a word processor because I don’t know why, but so it’s just this is what not using AI today is like.

You need to write it all on paper with the typewriter out. Ka-ching, ka-ching, ka-ching. Well, you’re just hurting your own bottom line because your people can’t be as productive. But give people an approved path. Shadow AI happens because of the approved options. It’s slower or it just doesn’t exist.

Copilot inside of Microsoft 365 with the right permissions. All cleaned up and ready beats a personal ChatGPT and your data stays in your tenant. So there’s Copilot. Claude has the right ways to do it. GPT has the right ways. All the big players have the right way to get AI to your employees.

The two-minute test

The two minute test. All right. So you want to know. Where are we? Where is my company today? With AI? We have a small, simple little tool to give you an idea of where you sit. So again, previously we had the AI policy, acsapp.com slash AI policy.

Now we have another little tool, little thing we’re giving away, which we’re calling the self-assessment. Goes over, do you have a written policy? Are your permissions set up right? Have you reviewed them? What else? Oh, you know. What tools your plays are using today?

So if you can’t answer all three of those right now, you’re not behind. You’re just normal. And we’re going to help you figure out where you’re at on the spectrum. We’ll take the 10 question version. It scores you and tells you what to do first. We’re not collecting anything. This is just a free check.

It’s at acsapp.com slash AI check. acsapp.com slash AI check. 10 questions. Couple of minutes. It’s going to tell you exactly where you’re at with your company from AI today. What you should be concerned about. All right. Take the test. You got the policy.

How ACS runs AI

Now what? Advanced Computer Solutions, ACS, has what I would describe as a highly advanced AI. Highly, we’ve leveraged it more than your average even managed service provider. We have our own in-house AI. That runs on our own hardware. We have leveraged all the most advanced models from all the biggest companies.

We know how to type crank down the spend. We know how to increase the capability. We’ve built software. We’ve built dozens, maybe even now. Well, definitely dozens close to a hundred integrations between our own software. Our vendors companies that we use for our tools.

So we know how to do this stuff and we know how to do it right. We know how to make it so data never leaves the building. We know how to configure it. So we like to call our solution to this AI thing Managed Intelligence or Managed Intelligence Provider. It’s the foundation. The policy is shadow AI monitoring, Copilot or other AI license management.

It’s a service that’s designed to have you run your business. Like, we run ours on an AI perspective. It’s a fully. It covers from the assessment all the way to creating agents, managing the agents, training your employees, creating workflows that make your employees more productive, getting everything configured right so that employees can use it correctly. It’s full-blown AI management service or what we like to call managed. Intelligence provider service. MIP. We’re the MIP service.

So, again, go get your free assessment.

Where to start this week

acsapp.com slash AI check. Go get your free download of the policy. That’s acsapp.com slash AI policy. Take those take that test get that policy give it to your team. And, uh, the next next next show is coming on Thursday. The regular show we talk about the news.

But we want to get this out because we knew that people are concerned and we have solutions cover those concerns. We’ve got knowledge that we can pass along and now we’ve got these great new tools that you can use internally. acsapp.com slash. AI. Check or the free check. acsapp.com. Slash. AI. Policy. acsapp.com slash AI policy. Your free policy document.

All right. I hope everybody has a good rest of the week. And I really appreciate all of you. Have a good day. Bye.